ofz#10635 oom in tight OUString concat loop

Change-Id: I56944e14b7d2b2dc0946b76360b906447e024f06
Reviewed-on: https://gerrit.libreoffice.org/61154
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

sw/source/filter/html/swhtml.cxx

@@ -1001,7 +1001,9 @@ void SwHTMLParser::NextToken( HtmlTokenId nToken )
             switch( nToken )
             {
             case HtmlTokenId::TITLE_OFF:
-                if( IsNewDoc() && !m_sTitle.isEmpty() )
+            {
+                OUString sTitle = m_sTitle.makeStringAndClear();
+                if( IsNewDoc() && !sTitle.isEmpty() )
                 {
                     if( m_xDoc->GetDocShell() ) {
                         uno::Reference<document::XDocumentPropertiesSupplier>
@@ -1011,39 +1013,39 @@ void SwHTMLParser::NextToken( HtmlTokenId nToken )
                             xDPS->getDocumentProperties());
                         OSL_ENSURE(xDocProps.is(), "no DocumentProperties");
                         if (xDocProps.is()) {
-                            xDocProps->setTitle(m_sTitle);
+                            xDocProps->setTitle(sTitle);
                         }
 
-                        m_xDoc->GetDocShell()->SetTitle( m_sTitle );
+                        m_xDoc->GetDocShell()->SetTitle(sTitle);
                     }
                 }
                 m_bInTitle = false;
-                m_sTitle.clear();
                 break;
+            }
 
             case HtmlTokenId::NONBREAKSPACE:
-                m_sTitle += " ";
+                m_sTitle.append(" ");
                 break;
 
             case HtmlTokenId::SOFTHYPH:
-                m_sTitle += "-";
+                m_sTitle.append("-");
                 break;
 
             case HtmlTokenId::TEXTTOKEN:
-                m_sTitle += aToken;
+                m_sTitle.append(aToken);
                 break;
 
             default:
-                m_sTitle += "<";
+                m_sTitle.append("<");
                 if( (nToken >= HtmlTokenId::ONOFF_START) && isOffToken(nToken) )
-                    m_sTitle += "/";
-                m_sTitle += sSaveToken;
+                    m_sTitle.append("/");
+                m_sTitle.append(sSaveToken);
                 if( !aToken.isEmpty() )
                 {
-                    m_sTitle += " ";
-                    m_sTitle += aToken;
+                    m_sTitle.append(" ");
+                    m_sTitle.append(aToken);
                 }
-                m_sTitle += ">";
+                m_sTitle.append(">");
                 break;
             }
 

sw/source/filter/html/swhtml.hxx

@@ -347,7 +347,7 @@ class SwHTMLParser : public SfxHTMLParser, public SwClient
     OUString      m_aScriptURL;     // script URL
     OUString      m_aStyleSource;   // content of current style sheet
     OUString      m_aContents;      // text of current marquee, field and so
-    OUString      m_sTitle;
+    OUStringBuffer m_sTitle;
     OUString      m_aUnknownToken;  // a started unknown token
     OUString      m_aBulletGrfs[MAXLEVEL];
     OUString      m_sJmpMark;